G0037 · 42 ATT&CK techniques · 0 correlated reports

FIN6

Aliases: Magecart Group 6, ITG08, Skeleton Spider, TAAL, Camouflage Tempest

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.

Open interactive actor investigation

ATT&CK techniques

T1560.003
Archive via Custom Method T1566.001
Spearphishing Attachment T1087.002
Domain Account T1059
Command and Scripting Interpreter T1572
Protocol Tunneling T1213
Data from Information Repositories T1027.010
Command Obfuscation T1059.007
JavaScript T1102
Web Service T1005
Data from Local System T1547.001
Registry Run Keys / Startup Folder T1059.003
Windows Command Shell T1588.002
Tool T1070.004
File Deletion T1003.003
NTDS T1134
Access Token Manipulation T1562.001
Disable or Modify Tools T1068
Exploitation for Privilege Escalation T1204.002
Malicious File T1036.004
Masquerade Task or Service T1566.003
Spearphishing via Service T1059.001
PowerShell T1560
Archive Collected Data T1553.002
Code Signing T1021.001
Remote Desktop Protocol T1119
Automated Collection T1018
Remote System Discovery T1053.005
Scheduled Task T1569.002
Service Execution T1046
Network Service Discovery T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol T1047
Windows Management Instrumentation T1110.002
Password Cracking T1555
Credentials from Password Stores T1095
Non-Application Layer Protocol T1078
Valid Accounts T1573.002
Asymmetric Cryptography T1003.001
LSASS Memory T1555.003
Credentials from Web Browsers T1074.002
Remote Data Staging T1069.002
Domain Groups T1074.001
Local Data Staging

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research